From: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
commit 60b45ece41c5632a3a3274115a401cb244180646 upstream.
The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as
part of their remove process, and if the driver is removed multiple
times, eventually leads to put "overflow", possibly causing memory
corruption or crash.
The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media:
i2c: ds90ub9x3: Fix sub-device matching"), which changed the code
related to the sd.fwnode, but missed removing these fwnode_handle_put()
calls.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching")
Reviewed-by: Jai Luthra <jai.luthra@xxxxxxxxxxxxxxxx>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/media/i2c/ds90ub913.c | 1 -
drivers/media/i2c/ds90ub953.c | 1 -
2 files changed, 2 deletions(-)
--- a/drivers/media/i2c/ds90ub913.c
+++ b/drivers/media/i2c/ds90ub913.c
@@ -792,7 +792,6 @@ static void ub913_subdev_uninit(struct u
v4l2_async_unregister_subdev(&priv->sd);
ub913_v4l2_nf_unregister(priv);
v4l2_subdev_cleanup(&priv->sd);
- fwnode_handle_put(priv->sd.fwnode);
media_entity_cleanup(&priv->sd.entity);
}
--- a/drivers/media/i2c/ds90ub953.c
+++ b/drivers/media/i2c/ds90ub953.c
@@ -1290,7 +1290,6 @@ static void ub953_subdev_uninit(struct u
v4l2_async_unregister_subdev(&priv->sd);
ub953_v4l2_notifier_unregister(priv);
v4l2_subdev_cleanup(&priv->sd);
- fwnode_handle_put(priv->sd.fwnode);
media_entity_cleanup(&priv->sd.entity);
}
Patches currently in stable-queue which might be from tomi.valkeinen@xxxxxxxxxxxxxxxx are
queue-6.6/media-i2c-ds90ub9x3-fix-extra-fwnode_handle_put.patch
queue-6.6/media-i2c-ds90ub960-fix-ub9702-vc-map.patch
queue-6.6/media-i2c-ds90ub960-fix-use-of-non-existing-registers-on-ub9702.patch
queue-6.6/media-i2c-ds90ub960-fix-ub9702-refclk-register-access.patch
queue-6.6/media-i2c-ds90ub960-fix-logging-sp-eq-status-only-for-ub9702.patch
